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Internet Monitoring System 



Paladion provides comprehensive range of solutions of Internet Monitoring to 
help Law Enforcement Agencies identify and track suspicious communication. 
Our Internet Monitoring system is a packaged product comprising software and 
hardware that can capture Internet traffic flowing to or from a given ISP location. 

It can monitor wide range of Internet protocols and filter them based on 
granular criteria. 

Product Range- 

Paladion Internet Monitoring solution is offered in following configurations- 
. Stand-alone system- The system caters to a single service provider and 
single user. The monitoring system is placed at service provider and the 
single user connects directly to use the system 

• Distributed system- When the requirement is to monitor several service 
provider simultaneously from single user premises. The distributed system 
allows unifies control and command for interception at various service 
provider locations 

• National platform- the national platform has multi-tier architecture to 
cater to several service providers across cities and several users located 
across regions with differing jurisdiction. The system acts as a common 
infrastructure to be used amongst various agencies and covering entire 
national communication traffic 

• Strategic data centric- This solution enables mass scale storage of 
communication in real time and post-facto data centric analysis to gain 
actionable intelligence. The strategic system is ideal for deep intelligence 
gathering by mining of stored data 

Product Features 

• Works at carrier grade speeds of 40G and storage capacity of 1 OOOTB 

• Supports all internet protocols including data, voice and video 

• Monitor various networks- gigabit, STM, wifi, wimax, optical, 
broadband, DSL 

• Advanced search feature for data centric analysis and behavior analysis 

• Can monitor up 10000 targets concurrently 

Benefits to customer 

• Comprehensive monitoring of the target traffic 

• Finding out new targets with the help of heuristic analysis 

• Easy to deploy and operate 

• Lowest cost solution in the market 
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Monitoring ol Landline & Cellphone Networks 



Paladion Telecom Operator Interception System (TIS), enables law enforcement 
agencies to manage and provision target subscribers in telecom operator network 
as well as obtain the intercepted call content along with required call related 
information over prescribed standard interface. The intercepted contents like 
voice files, fax files, IP world protocols, SMS content along with respective call data 
records or call related information are extracted transparent to the network and 
targets. The system can be deployed to various communication networks like 
GSM, CDMA, PSTN, WLL and Broadband Networks to intercept subscriber's 
communication and delivers it to security agencies. 



Paladion Telecom Operator Interception System is a powerful solution for large 
scale interception in a round the clock operation and gives you the ability to record 
all conversations and messages of target. The powerful search & playback facility 
allows you to easily & quickly search, sort and listen to any recorded conversation 
and view any intercepted message. 

System Highlights- 

• Monitor various networks- PSTN, Broadband, GSM, CDMA, GPRS, 3G 

• Handles voice, sms, multimedia and IP packets 

• Real time target provisioning and interception 

• Multi-agency support with tiered architecture 

• Advanced post-capture analysis 

• Compliant to global standards 

Features & Functionality 

• Target Provisioning- The system allows for easy and quick target provisioning 
along multiple dimensions. Targets can be provisioned by users directly to 
the operator's network seamlessly 

• Case Categorization- The system uses artificial intelligence techniques to 
automatically categorize the captured information into user defined cases 

• Post capture analysis- Post capture analysis graphical link analysis, multi- 
dimension visualization, temporal and spatial cross-correlation, speech 
recognition and GIS analysis 

• Mass interception & storage- System can provide for mass interception of 
large scale data and storage with features for fast analysis of stored data. 
Several built-in search options can automate discovery of actionable 
intelligence under mass interception 






Unified Monitoring Platform 



Paladion provides state of the art platform for unified Monitoring of voice, data 
and multimedia content across service providers, ranging from Internet Service 
Providers, Telephone Operators, Mobile Operators and satellite communication 
providers. Our Unified Monitoring system helps in centrally collecting and 
managing interception data from variety of networks, be it voice, SMS, fax, 
Internet data or video communications.. 

Product Architecture-The unified monitoring system has following components 

1. Universal probes - The probes are placed at service provider network and 
captures the communication over the network. The probe can be placed for 
wireline (PSTN), wireless (GSM, CDMA), packet based network (Internet) 
service providers 

2. Centralized collection system- The centralized collection system connects to 
all the installed probes to receive the captured communication. This system 
can scale up to handle thousands of installed probes 

3. Unified analysis platform- The analysis platform carries out both individual 
analysis of communication and cross-analysis from disparate communication 
network. While enabling faster targeting of specific communication, it also 
helps in deriving higher intelligence through advanced correlations amongst 
multiple channelsof communication. 

Our system helps law enforcement agencies to reduce cost and effort 
through a single platform for monitoring and analysing across multiple channels. 
And it also allows for cross-correlation of target's communication flowing through 
multiple channels. 

System Highlights- 

• Monitor various networks- PSTN, GSM, CDMA, UMTS, Gigabit Ethernet, STM, 
Wifi, DSL, Optical from single platform 

• Unified view of all target activities across network 

• Advanced post-capture analysis and cross-correlations 

• Lower complexity and cost of ownership 

Features & Funct ionality- 

• Target Definition- The system allows for target definitional along multiple 
dimensions. These can be combination of keywords, logical Ids, locations, IP 
addresses, telephone numbers, communication protocols, time etc. The 
targets can be selectively defined for each operator and location or can be 
applied in mass across groups of operators 

• Case Categorization- The system uses artificial intelligence techniques to 
automatically categorize the captured information into user defined cases 

• Advanced analysis- the system provides advanced features for social network 
analysis, contextual analysis, speech recognition, location tracking and 
query builder 







Portable Monitoring device 



Paladion's portable monitoring device is an effective monitoring tool for tactical 
operations. Often, agencies are required to gather local communication traffic 
for suspected targets. These might include a short term monitoring of a local ISP 
or its sub network in a city. It could also involve need based monitoring of a 
public LAN or corporate LAN or any termination point between networks. 

A portable Monitoring device will help LEAs to easily target an organization or 
individual by tapping into his communication via Internet and telephone. The 
portable device comes along with it all the accessories like Taps, Interface cards 
etc to cater to all types of traffic inputs such as El, GE, FE, STM1/4/16, WiFi etc. It 
can be used for data centric or target centric operations. 

Features 

• Handle traffic up to lGbps 

• Storage space up to 2TB 

• Supports all major Internet protocols 

• Self contained accessories for quickly connecting to any form of link 
(copper/ OFC, ethernet/ STM/ E 1/, VLAN, MPLS, ADSL etc...) 

• Does Data centric and target centric operation 

• Extremely rugged and can be used in harsh environmental conditions 

Benefits to customer 

• Easy to target an individual or corporate once the source of their 
communication channel is identified 

• Easy to carry and deploy 

• Can be remotely accessed and used 

• Dump data for considerably long time for forensic analysis 
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Cyber Cafe monitoring 



Interception and monitoring of network traffic in a cybercafe is occasionally 
required by law enforcement agencies. However enabling such monitoring of 
traffic is usually difficult as it requires either reconfiguration of the cybercafe 
network or putting in network taps and multiple hardware/ software in the 
cybercafe. It also requires skill and knowledge on networking and interception 
technologies on part of law enforcement personnel. Furtheron, the cost of 
installing such product across cybercafe is usually prohibitive. 

Paladion's cyber cafe monitoring system is an all-in-one plug and play device. 
With innovative technologies, Paladion has integrated all features of 
interception, network configuration, packet analysis and reporting in a single 
low price hardware device. The device can work at line speed and capture high 
bandwidth traffic in cybercafe. It can be installed in few minutes into any 
cybercafe network by law enforcement personnel without any skills on 
networking or interception technologies. This highly portable and lightweight 
device can be carried without suspicious to locations that require monitoring. 

Once installed the system can capture all packets and silently monitor for 
suspicious traffic. It can analyse various protocols and reconstruct user sessions. 
It is capable of decoding and reconstruct WLAN Internet traffic in real time such 
as Email (POP3, SMTP, IMAP), Webmail (Gmail, Yahoo Mail, Windows Live 
Hotmail etc.), Instant Messaging/Chat (MSN/Windows Live Messenger, Yahoo 
Messenger, IRC, ICQ, QQ, UT Chat Room, Google Talk), FTP, P2P, TELNET, HTTP 
(URL, Content, Download/Upload) etc. It can also decrypt SSL traffic if installed 
in MITM configuration. 



Features 

• Handles traffic up to 100Mbps with build in storage of up to 500GB 

• Works in fully stealth mode with no IP address 

• Can be used as data logger for forensic analysis or for monitoring specific 
targets 

• It can perform target centric and data centric operations on the data 

• It can monitor SSL sites 

• Can scale up to thousands of cyber cafe 



Benefits to customer 

• Hassle free deployment at any cyber cafe 

• Complete tracking of the cyber cafe where it is deployed 

• Remote control of the system from LEA premises 

• Solution for low cost and quick deployment at cybercafe 









SSL Interception & Decryption System 



LEAs as a part of their normal activities would be required to track 
communication between suspects. This becomes impossible if the suspects 
communicate over an SSL enabled site, which encrypt the content of 
communication. Paladion's SSL interception software is helpful in such scenario. 

It has build a fully operational system for SSL interception solution at 1 Gbps of 
traffic in real time. The solution works by being man-in-the-middle for the 
communication of suspects. 

Working Method 

The interception of SSL sites are carried in following manner- 

• Paladion's SSL Interception System is placed in line of the communication 
by inserting it in the network. This system is then configured as proxy server 
to intercept the traffic. The proxy also has capability to incorporate 
appropriate certificate and encryption key 

• Alternately, if the proxy solution is not desired, then the SSL Interception 
System can be positioned in parallel to the gateway router or edge router. 
The router is configured to divert the specific SSL traffic to the interception 
system. The interception system then decrypts as well as acts similar to 
man-in-middle equipment 

• In either of the above two cases, the SSL traffic of the suspect is intercepted, 
decrypted and then analysed, while allowing the original communication to 
be conducted unhindered 

Features 

• Intercept all the SSL communication happening in the IP address and the IP 
address range from which the traffic is forwarded 

• Filter traffic based on keywords, email address etc... 

• Can handle up to 2500 concurrent connections 

• Works in the stealth mode 

Benefits to customer 

• Track all SSL traffic from an IP address or IP address range 

• Track the suspects encrypted communication using Gmail, Hush mail etc... 

• Track the suspects banking transactions etc.. 
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Handheld Wifi Monitoring 



LEAs often find it difficult to track a WiFi hotspot clandestinely. This is 
because the portable WiFi devices are not small enough to be hidden 
completely. Paladion has launched a revolutionary product for wifi 
monitoring that is the smallest and lightest in the world currently. This 
handheld device with 7 inch screen has fully built-in wifi interception 
software and accessories and requires no additional equipment. Being 
extremely lightweight and small, it can be easily and secretly carried by 
forensic professional to any place that requires wifi monitoring. Forensic 
professionals can avoid any notice while carrying this handheld, which is 
designed as a PDA/ mobile phone. 

Paladion's Wifi interception device has comprehensive features for 
forensic investigation by law enforcement agencies. It is the most reliable 
solution in market today to monitor illegal Wireless LAN Internet activities 
or transactions in most secret manner for law enforcement agencies. 

Features 

• Capture multiple channels for 802 . 1 1 a/b/g 

• Full packet capture and decoding functionality 

• Supports all major TCP and UDP protocols 

• Up to 40G of HDD space for data capture 

• Free text search and Boolean operations 

• Intuitive and touch screen enabled GUI 

Benefits to customer 

• Easy to carry and deploy 

• Very small in size and can be hidden from others 

• Immediate analysis of the data at the target location 

• Dump data and carry back for forensic analysis 





Remote Desktop/ Laptop Monitoring 



On several occasions, LEAs may require to access the data stored in suspect's 
desktop or laptop. This could include getting the files, emails, web browsing 
history and other such data. While computer forensics tool enable analysis of 
computers in possession of LEAs, in some cases such analysis may be required 
for remote computers which may or maynot be in possession of LEAs. 

Paladion remote analysis tool helps LEA to analyze the content of desktop or 
laptop from a remote location and without the knowledge of the user. These can 
include documents, images, emails and any other data stored on local computer. 
More over the tool can also track all activities on the computer such as chats, 
voice calls and keystrokes. 

The system has client server architecture with multiple remote clients 
controlled by central server. The server program can search for files with certain 
contents, get all the keystrokes, get VOIP data, chat clients etc... The client can be 
installed on remote computers in several manner and can be made difficult to 
detect on the system. 




Features 

• Remotely gathers data from computer 

• Search for files and emails with keywords 

• Search for deleted files with certain contents 

• Get all the keystrokes, VOIP communication, chat sessions 

• Works transparently in the computer and hard to detect 

• Full featured search and retrieval of data 

• Scale up to multiple simultaneous search operations 

Benefits to customer 

• Complete access to a suspect's computer 

• Unearth variety of information from the computer 

• Highly covert operation 

• Gain access to encrypted communication in free form 









Granular Webpages Blocking 



Law Enforcement Agencies and other Government bodies (together referred 
henceforth as LEAs), are usually asked to stop certain Internet activities for 
public safety or national security. However blocking such sites is not always easy. 
Several times, such sites may be micro-site or the pages existing within another 
parent URL. Many times, a single server (IP address) hosts multiple websites and 
the need is to block only selected site and allow other sites on the same server 
from being accessed. LEAs should be able to block such specific pages and not 
have complete blocking of all websites or webpages. 

In order to avoid overblocking while still effectively block a particular webpage/ 
website, Paladion provides unique website blocking solution. The solution 
carries out deep packet inspection at speeds of lOGbps and provides granular 
blocking. 

Working Method 

The granular blocking of webpages is carried in following manner- 

• A deep packet based URL blocking device is connected in parallel to the edge 
router either at ISP network or at national gateways 

• The IP addresses or range of addresses is selectively diverted from the 
routers to the URL blocking devices 

• The blocking devices analyses the content of packets and determines 
whether the appropriate webpage exists. If so, it will block the 
communication, else it allows the communication to be routed back 
through the edge router to Internet 

Features 

• Supports bandwidths up to lOGbps 

• Supports blocking up to 5000 websites or pages 

• Prevents overblocking while effectively blocking required pages 

• Websites are blocked based on deep packet inspection 

• Blocks communication even if the user uses Web proxy 

• Works in high available mode. 

Benefits to Customer 

• Specific Websites or URLs can be blocked 

• Handles very high traffic of lOGbps 

• Effective blocking with minimal false positives 

• Cannot be bypassed using Web proxy 








Link Analysis 







As people communicate over data and voice network, they create a senes of 
interlinkages. Analysis of such interlinkages can provide valuable information on 
the network of suspect. Manual analysis of millions of communication is never 
an option and LEAs require specialized tools for carrying out link analysis. 

Paladion's Link analyzer is a tool which can be deployed along with Internet 
Monitoring System (IMS) and Telecome Monitoring System (for landhne & 
Cellphone network) to get the metadata of various communications, for 
example, the link analyser can collect email communications in real time and 
create dynamic updated links of suspect's communication. 

The linkages can be generated for individuals or groups or even for 
geographic locations. Using metadata an LEA person can drill down into the 
communication details of a suspect. It will give the details of h.s contacts, 
the frequency of the communication with others, type of communication, 
time of communication etc... 



. Graphical representation of a suspect's communication 

. Direct and indirect links of suspect's friends and associates 

» Advanced filtering mechanism to fine tune the graphs 

• Capture the metadata at lOGbps speeds 

. Advanced search options to drill down to suspects communication 

. Can work on POP3, SMTP and Webmail 

Benefits to customer 

• Track the communication of any suspect 

• Track a group's activity as a whole 

. Determine the degree of separation between two suspects 

• Can find out anchor person in the group 







Computer and Cellphone Forensics 

Paladion specializes in setting up cyber forensic labs for LEAs who are 
interested in analysis of data in computer and various handheld devices. 
Paladion provides full solution from hardware and software delivery, 
training, implementation and in assisted case management. Paladion 
also provides services for developing methods and documents for 
carrying out various investigative tasks. 

The list of hardware and software delivered by Paladion includes- 

1. Disk Forensics- software and hardware for forensic analysis of data 
in computer disk. This also includes accessories for data acquisition 
and data duplication in secure manner. The system can carry out 
free tex search, recover damaged or deleted files, analyse images 
and various historical user activities. 

2. Cellphone Forensics- Software and hardware for forensic analysis 
of data in various handheld devices. It supports multiple mobile 
operating system platform. Also includes system for analysis of SIM 
cards. 

3. Damaged hard disk analysis- provides system for analysis and 
retrieval of data from partially damaged hard disks. The damages 
can include from hard drive component failure, media surface 
contamination to physical damges or damages due to fire and 
water. 

4. Network traffic analyzer- product for capturing and visually 
analyzing the computer traffic flowing through an network. The 
product scales up to handle over 10 Gbps of bandwidth. The system 
also supports log analysis and file regeration from network traffic. 

5. Investigation case management- Automated workflows, case 
management and data storage system for secure management of 
forensic cases. 

6. Supporting Tools- Password breaking tools, steganography 
detection tools, hardware blockers, disk wipers and other 
accessories required in a forensic lab. 

It is imperative that evidence be collected by trained computer forensic 
experts that follow forensically sound processes to ensure that the 
resulting digital evidence withstands legal scrutiny. Paladion provides 
turn key solution for setting up forensic labs with all processes and 
training. 




About Paladion 




Paladion is the fastest growing information security 
company in Asia (as ranked in Deloitte Technology 
Fast 500 Asia Pacific 2006, 2007, 2008 & 2009). With 
a global footprint across 15 countries and decade of 
experience in the information security domain, 
Paladion today is actively managing security for over 
450 customers. It provides security assurance, 
compliance, governance, monitoring and 
management services to large and medium sized 
organizations. 

Paladion also offers solutions for communication 
interception to law enforcement agencies and 
service providers. Paladion's security solutions have 
been awarded by Asian Banker, Red Herrings, and 
Financial Insights. Paladion is also included in 
Gartner's rating of "MarketScope for Managed 
Security Services in Asia Pacific." 

Paladion is involved in several security research 
forums and has authored books on security 
management. 
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Deloitte 

Fastest growing security company in 
Asia & featured in Technology Fast 500 
AsiaPac 2006, 2007, 2008 & 2009. 
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Top 100 Finalist in 
2007 & 2008. 



‘ Tomorrow's Technology Today ' FIIA 2009 for innovation in 

for application security in 2009 Enterprise Security Management 
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PALADION 



Bangalore Mumbai 

Shilpa Vidya, 49 1st Main, 3rd Phase 606, A Wing, 6th Floor, Technocity 
JP Nagar, Bangalore 560078 Mahapae, Navi Mumbai 400710 

Phone: +91 80 42543444 Phone: +91 22 41615151 

Fax: +91 80 41208929 Fax: +91 22 41615161 

LONDON: +44 (0)845 2270777, GERMANY: +49 711 7224 9626, 
SHARJAH: +971 50 8344863, RIYADH: +966 1 291 0110, QATAR: +974 66184607, 
MALAYSIA: +60 3 7660 4988, VIRGINIA: +1 703 8713934, 

SAN JOSE: +1 408 4513940, TORONTO: +1 416 273 5004 
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